You explicitly call out imap and other email protocols. Can this be applied to LDAP?

LDAP (think Active Directory if you are short of imagination, and/or experience).

A lot of connections use STARTTLS on port 389 instead of full on explicit TLS on port 636. Then there are the other two ports for the "global catalogue" which I think is basically a Win NT style domain flat lists for users and groups on 3268/tcp and 3269/tcp.

I've always had my suspicions about STARTTLS but it looked quite convincing to a sysadmin and was always encouraged by the sort of people who use terms like: "best practice". I'll start dumping it from now on. This will take a while.

NBD[1] is another protocol that uses STARTTLS, although as a protocol it's not commonly exposed on the internet (and in fact encryption is not commonly used either since most people are interested in pure performance). We've tried to mitigate the worst effects by reducing the types of message that are permitted before you upgrade to TLS to the bare minimum.

[1] https://github.com/NetworkBlockDevice/nbd/blob/master/doc/pr...